Mexican district courts spent May 2026 fielding a wave of amparo (constitutional injunction) suits against the country's mandatory mobile-line registry, with several plaintiffs winning provisional suspensions that bar carriers from cutting their service. The trigger is a hard deadline: under guidelines the new Comisión Reguladora de Telecomunicaciones (CRT) approved on December 8, 2025, every active line must be tied to a verified identity, and unregistered numbers face suspension starting July 1, 2026. With 144.59 million active mobile lines counted by the CRT in the third quarter of 2025, this is one of the largest forced-identification exercises in the hemisphere.
There is a real problem behind the policy, and it deserves a fair hearing.
The case for the registry
Anonymous prepaid SIMs are a genuine tool of extortion, virtual kidnapping, and cartel logistics in Mexico. When a collegiate court in March 2026 overturned an early suspension (review proceeding 27/2026), it reasoned that blocking the rules would impede the State's ability to search for and identify disappeared persons — a crisis touching more than 100,000 families. Linking a number to a name is, on its face, a modest ask: most countries already require ID for SIM activation, and the CRT framed its rules as an extension of Mexico's existing prepaid-registration practice. A regulator trying to make telecom infrastructure less useful to organized crime is pursuing a legitimate aim.
The trouble is not the aim. It is the design, the history, and the missing guardrails.
A database the Supreme Court already struck down — twice
Mexico has run this experiment before. In April 2022, ruling on Acción de Inconstitucionalidad 82/2021, the Supreme Court (SCJN) invalidated PANAUT, the previous national mobile-user registry, because it compelled users to hand over biometric data — fingerprints, and in some versions facial and iris scans — to a centralized database. The Court found the scheme failed the constitutional proportionality test: there were less intrusive ways to achieve public security, and a single honeypot of biometric records on tens of millions of citizens created risks that outweighed the benefit. Biometric collection, the Court held, is permissible only in exceptional cases.
That ruling is why the 2026 version looks different. The CRT's December guidelines require an official ID — voter credential or passport — plus the CURP population code. They do not, on their text, demand fingerprints or iris scans for a phone line. The biometrics were stripped out because the judiciary forced the issue. The registry now standing is, in effect, the constitutionally survivable remainder of a scheme courts have repeatedly rejected.
Where the danger re-enters is through the back door of the biometric CURP. The government is separately migrating the CURP into a biometric national identity — capturing fingerprints, face, and iris — and weaving it through a centralized identity platform. Digital-rights group R3D filed amparos on September 2, 2025 against exactly this package, arguing it normalizes "mass and indiscriminate surveillance" by tying any public or private service, telecom lines included, to a biometric record accessible without prior judicial order. A phone padrón that asks only for CURP today becomes a biometric padrón the moment the CURP itself is biometric. The Court closed the front door; the policy is reaching for the window.
The watchdog problem
The second structural flaw is institutional. Mexico is building a mega-database of identity-linked telecom data at the precise moment it has dismantled the independent body that would have policed it. On March 21, 2025, the autonomous data-protection authority INAI was formally extinguished, and its enforcement powers were transferred to the Secretaría Anticorrupción y Buen Gobierno — an arm of the executive branch. The entity now responsible for protecting citizens' data from government overreach is itself part of the government collecting it. That is not a hypothetical conflict; it is the textbook definition of one, and it removes the institutional check that made the 2010 LFPDPPP framework credible.
Data breaches make this concrete. The same month these suits were filed, the University of Nottingham confirmed a breach exposing passport numbers and protected characteristics of roughly 455,000 people. Centralized identity stores are high-value targets precisely because they are centralized; the question is never whether such a database leaks, but when and how badly. Conditioning access to an essential service — a phone line is now a prerequisite for banking, health appointments, and government benefits — on enrollment in such a store shifts the risk entirely onto the citizen.
The proportionate path
None of this requires choosing between public safety and privacy. A proportionate registry would: keep identification to verified official ID without biometric capture, as the CRT's current text already does; firewall the phone padrón from the biometric CURP and from real-time intelligence access absent a judicial warrant; restore an independent data-protection authority with the power to audit and sanction the government, not just private firms; and replace automatic service suspension with a graduated, contestable process so that a missed deadline cannot sever a person's connectivity overnight.
The amparo wave is doing the work an independent regulator should have done up front. Mexican courts are, in effect, re-imposing the proportionality discipline that INAI can no longer supply — line by line, injunction by injunction. That is a costly and unpredictable way to protect a fundamental right. The lesson for any jurisdiction tempted by a national identity-linked telecom registry is that the safeguards are not optional add-ons. Strip out the independent oversight and the data minimization, and you are left with the database the Mexican Supreme Court has already told you that you cannot build.